You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by "Chinmay N Hegde (Jira)" <ji...@apache.org> on 2026/10/21 13:19:00 UTC

[jira] [Created] (RANGER-5855) KMS key ACL bypass via uppercase key name

Chinmay N Hegde created RANGER-5855:
---------------------------------------

             Summary: KMS key ACL bypass via uppercase key name
                 Key: RANGER-5855
                 URL: https://issues.apache.org/jira/browse/RANGER-5855
             Project: Ranger
          Issue Type: Bug
          Components: kms, Ranger
    Affects Versions: 3.0.0
            Reporter: Chinmay N Hegde
            Assignee: Chinmay N Hegde


Ranger KMS stores encryption keys in a case-insensitive manner — all key names are converted to lowercase internally before storing in DB. However, the per-key ACL authorisation check is case-sensitive. An authenticated user can bypass per-key ACLs by requesting the key name in a different case (e.g, TESTKEY instead of testkey).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)